CVE-2008-3009: Microsoft Windows Media Format Runtime

High severity, CVSS 10.0. EPSS: 15.8% chance of exploitation in the next 30 days.

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."

Affected products

• Microsoft Windows Media Format Runtime: version 7.1 only; version 11 only; version 9.5 only; version 9 only
• Microsoft Windows Media Player: version 6.4 only
• Microsoft Windows Media Services: version 4.1 only; version 9 only; version 2008 only

Published 2008-12-10. Last modified 2026-06-16.